Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

2007-09-20 Thread Erik de Castro Lopo
Nico Golde wrote: > Hi, > * Erik de Castro Lopo <[EMAIL PROTECTED]> [2007-09-21 02:16]: > > Nico Golde wrote: > > > > > If you fix this bug please include the CVE id in the > > > changelog data. > > > > I has already beedn fixed, so there is no mention of the CVE id > > in the changelog. > > A

Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

2007-09-20 Thread Nico Golde
Hi, * Erik de Castro Lopo <[EMAIL PROTECTED]> [2007-09-21 02:16]: > Nico Golde wrote: > > > If you fix this bug please include the CVE id in the > > changelog data. > > I has already beedn fixed, so there is no mention of the CVE id > in the changelog. At least 1.0.17-3, testing and stable were

Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

2007-09-20 Thread Samuel Mimram
Erik de Castro Lopo wrote: > Nico Golde wrote: > >> If you fix this bug please include the CVE id in the >> changelog data. > > I has already beedn fixed, so there is no mention of the CVE id > in the changelog. Do you mean that it is already fixed in the version that Debian is shipping (1.0.17

Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

2007-09-20 Thread Erik de Castro Lopo
Nico Golde wrote: > If you fix this bug please include the CVE id in the > changelog data. I has already beedn fixed, so there is no mention of the CVE id in the changelog. > [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974 Err, that URL doesn't give me anything useful. Erik --

Bug#443386: CVE-2007-4974 heap overflow via crafted PCM data

2007-09-20 Thread Nico Golde
Package: libsndfile Version: 1.0.16-1 Severity: grave Tags: security Hi, a CVE was published for libsndfile. CVE-2007-4974[0]: Heap-based buffer overflow in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a blo